Application Security

In October 2026 two critical vulnerabilities hit the PHP core. CVE-2026-109618 and CVE-2026-109619. Researchers nicknamed them PHP2Shell. The CVSS v4.0 score reached 9.2. That score sits near the top of the scale. These flaws allow remote code execution. No login is needed. No application bug is needed. The problem lives one layer below your code. PHP2Shell is not a flaw in your application. It lives inside PHP itself. The feature at fault is called session.upload_progress. Most developers never configure it by hand. If your server runs an unpatched PHP version and accepts file uploads you may be exposed. This holds true regardless of how carefully your own code was written. Good application security practices do not block this path.

PHP2Shell is the industry nickname for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, discovered in PHP’s core runtime and rated CVSS v4.0 9.2. Together they allow unauthenticated remote code execution, meaning an attacker needs no credentials to run arbitrary commands on a vulnerable web server. The bugs stem from PHP’s historical use of longjmp() for fatal errors and incomplete cleanup of request-owned or global state across requests on the same worker process - manifesting as an out-of-memory corruption flaw and a use-after-free in stale global state, respectively. Discovered with AI assistance in August 2026, details leaked ahead of PHP’s planned October 21 disclosure, forcing an emergency early patch release. Because the flaws live in PHP itself rather than any single application, exposure spans nearly every PHP-based site, including WordPress, Drupal, and Joomla installations. Active in-the-wild exploitation has been observed. The only complete fix is upgrading to a patched PHP version; no configuration change fully closes the hole.